deadbyte-mcp 0.15.43 → 0.15.45

package/src/r67-evidence-reconcile.mjs

@@ -0,0 +1,128 @@
+import {createHash} from 'node:crypto';
+import {readFile,readdir} from 'node:fs/promises';
+import path from 'node:path';
+import {createR67ShardPlan,reconcileR67Shards,r67RegressionTreeHash,r67ShardTimeoutMs} from './r67-regression-shards.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const hex=x=>typeof x==='string'&&/^[a-f0-9]{64}$/.test(x);
+const equal=(a,b)=>JSON.stringify(a)===JSON.stringify(b);
+const idPattern=/^[a-z0-9][a-z0-9._-]{5,63}$/;
+async function jsonAt(file){
+ try{return {value:JSON.parse(await readFile(file,'utf8'))};}
+ catch(e){return {error:e.code==='ENOENT'?'MISSING':'INVALID_OR_UNREADABLE'};}
+}
+
+/**
+ * Independent evaluator. No processes executed, no mutations. Test can inject a
+ * disposable root; production CLI passes the actual candidate + evidence root.
+ * Result hashes are integrity checks, NOT signatures.
+ */
+export async function reconcileR67Evidence({root,evidenceRoot,operationId,sourceHashOptions}){
+ if(!idPattern.test(operationId??'')||typeof root!=='string'||!root||typeof evidenceRoot!=='string'||!evidenceRoot)
+  throw new Error('bounded root, evidence directory and operation identity required');
+ const testNames=(await readdir(path.join(root,'test'))).filter(n=>n.endsWith('.test.mjs')).map(n=>'test/'+n).sort();
+ const plan=createR67ShardPlan(testNames,32);
+ const hashes=[];
+ for(const name of testNames)hashes.push([name,sha(await readFile(path.join(root,name)))]);
+ const testTreeSha=sha(Buffer.from(JSON.stringify(hashes)));
+ const tree=await r67RegressionTreeHash(root,sourceHashOptions);
+ const verified=[],faults=[],stale=[],unknown=[],unclassified=[],classified=[];
+ for(const shard of plan.shards){
+  const dir=path.join(evidenceRoot,operationId+'-shard-'+String(shard.index).padStart(2,'0'));
+  const inFile=await jsonAt(path.join(dir,'intent.json'));
+  if(inFile.error==='MISSING')continue;
+  if(inFile.error){faults.push({index:shard.index,reason:'INTENT_'+inFile.error});continue;}
+  const outFile=await jsonAt(path.join(dir,'result.json'));
+  if(outFile.error==='MISSING'){unknown.push(shard.index);continue;}
+  if(outFile.error){faults.push({index:shard.index,reason:'RESULT_'+outFile.error});continue;}
+  const intent=inFile.value,result=outFile.value;
+  if(!result||typeof result!=='object'||Array.isArray(result)||!intent||typeof intent!=='object'||Array.isArray(intent)){
+   faults.push({index:shard.index,reason:'NOT_OBJECT'});continue;
+  }
+  const {receipt_sha256,...receiptBody}=result;
+  const v1=result.schema==='deadbyte.r67-shard-result.v1';
+  if((!v1&&result.schema!=='deadbyte.r67-shard-result.v2')||
+     intent.schema!=='deadbyte.r67-shard-intent.v1'||
+     intent.operation!==operationId||result.operation_id!==operationId||
+     intent.shard_index!==shard.index||result.shard_index!==shard.index||
+     !hex(receipt_sha256)||receipt_sha256!==sha(Buffer.from(JSON.stringify(receiptBody)))||
+     !hex(intent.plan_sha256)||!hex(result.plan_sha256)||
+     !hex(intent.files_sha256)||!hex(result.files_sha256)||
+     !hex(intent.test_tree_sha256)||!hex(result.test_tree_sha256)||
+     !Array.isArray(intent.files)||intent.files_sha256!==sha(Buffer.from(JSON.stringify(intent.files)))||
+     intent.plan_sha256!==result.plan_sha256||
+     intent.files_sha256!==result.files_sha256||
+     intent.test_tree_sha256!==result.test_tree_sha256||
+     (intent.source_tree_sha256!==undefined&&intent.source_tree_sha256!==result.source_tree_sha256)||
+     (intent.source_file_count!==undefined&&intent.source_file_count!==result.source_file_count)){
+    faults.push({index:shard.index,reason:'RESULT_DIGEST_OR_IDENTITY_INVALID'});continue;
+  }
+  if(v1){stale.push(shard.index);continue;}
+  if(!hex(result.source_tree_sha256)||!hex(intent.source_tree_sha256)||
+    !Number.isSafeInteger(result.source_file_count)||!Number.isSafeInteger(intent.source_file_count)||
+    !Number.isSafeInteger(result.configured_timeout_ms)||result.configured_timeout_ms<1000||
+    !hex(result.stdout_sha256)||!hex(result.stderr_sha256)||
+    typeof result.timed_out!=='boolean'||!Number.isFinite(result.elapsed_ms)||result.elapsed_ms<0||
+    !(result.failure_reason===null||(typeof result.failure_reason==='string'&&result.failure_reason.length>0))||
+    !['PASS','FAILED','OUTCOME_UNKNOWN'].includes(result.status)||
+    (result.status==='PASS'&&(result.timed_out||result.failure_reason!==null||result.exit_code!==0))){
+    faults.push({index:shard.index,reason:'V2_CONTRACT_INVALID'});continue;
+  }
+  if(result.nonpass_cases!==undefined){
+    const cases=result.nonpass_cases;
+    const valid=Array.isArray(cases)&&cases.length<=10000&&
+      cases.every(c=>c&&typeof c==='object'&&!Array.isArray(c)&&
+        ['SKIP','TODO'].includes(c.kind)&&typeof c.name==='string'&&
+        c.name.length>=1&&c.name.length<=256&&!/[\x00-\x1f\x7f-\x9f]/u.test(c.name)&&
+        (c.reason===null||(typeof c.reason==='string'&&c.reason.length>=1&&c.reason.length<=256&&!/[\x00-\x1f\x7f-\x9f]/u.test(c.reason))))&&
+      cases.filter(c=>c.kind==='SKIP').length===result.skipped&&
+      cases.filter(c=>c.kind==='TODO').length===result.todo&&
+      result.nonpass_fully_classified===cases.every(c=>c.reason!==null);
+    if(!valid){faults.push({index:shard.index,reason:'NONPASS_LEDGER_INVALID'});continue;}
+  }
+  if(intent.test_tree_sha256!==testTreeSha||result.source_tree_sha256!==tree.sha256||
+     result.source_file_count!==tree.file_count||
+     result.configured_timeout_ms!==r67ShardTimeoutMs(shard)||
+     intent.plan_sha256!==plan.plan_sha256||intent.files_sha256!==shard.files_sha256){
+    stale.push(shard.index);continue;
+  }
+  // New failure identity extension applies only to current-source receipts; pre-extension
+  // historical v2 receipts stay STALE_SOURCE rather than a fabricated tampering charge.
+  if(result.failure_cases!==undefined||result.failure_cases_complete!==undefined||result.failed>0){
+   const cases=result.failure_cases;
+   const valid=Array.isArray(cases)&&cases.length<=128&&
+     typeof result.failure_cases_complete==='boolean'&&
+     cases.every(c=>c&&typeof c==='object'&&!Array.isArray(c)&&
+       Object.keys(c).sort().join('|')==='name|name_sha256'&&
+       typeof c.name==='string'&&c.name.length>0&&c.name.length<=256&&
+       !/[\x00-\x1f\x7f-\x9f]/u.test(c.name)&&hex(c.name_sha256)&&
+       (c.name==='[redacted]'||sha(Buffer.from(c.name,'utf8'))===c.name_sha256))&&
+     (result.failure_cases_complete?cases.length===result.failed:cases.length<=result.failed);
+   if(!valid){faults.push({index:shard.index,reason:'FAILED_CASE_LEDGER_INVALID'});continue;}
+  }
+  verified.push(result);
+  if(result.status==='OUTCOME_UNKNOWN')unknown.push(shard.index);
+  if(result.skipped>0||result.todo>0||result.cancelled>0){
+   const caseEvidence={index:shard.index,skipped:result.skipped,todo:result.todo,cancelled:result.cancelled,...(Array.isArray(result.nonpass_cases)?{cases:result.nonpass_cases}:{}),...(typeof result.nonpass_fully_classified==='boolean'?{fully_classified:result.nonpass_fully_classified}:{})};
+   if(result.cancelled===0&&result.todo===0&&result.nonpass_fully_classified===true&&
+      Array.isArray(result.nonpass_cases)&&result.nonpass_cases.length===result.skipped&&
+      result.nonpass_cases.every(c=>c.kind==='SKIP'&&typeof c.reason==='string'&&c.reason.trim().length>0))classified.push(caseEvidence);
+   else unclassified.push(caseEvidence);
+  }
+ }
+ const verdict=reconcileR67Shards(plan,verified);
+ const status=faults.length?'FAILED_INTEGRITY':
+  stale.length?'STALE_SOURCE':
+  unknown.length?'OUTCOME_UNKNOWN':
+  verdict.status!=='PASS'?verdict.status:
+  unclassified.length?'BLOCKED_NONPASS_CLASSIFICATION':'PASS';
+ return {
+  schema:'deadbyte.r67-persistent-regression-reconciliation.v2',
+  operation_id:operationId,status,plan_sha256:plan.plan_sha256,
+  test_tree_sha256:testTreeSha,source_tree_sha256:tree.sha256,
+  source_file_count:tree.file_count,test_file_count:plan.file_count,
+  verified_receipts:verified.length,integrity_faults:faults,
+  stale_indices:stale,unknown_indices:unknown,unclassified_nonpass:unclassified,classified_nonpass:classified,
+  verdict,production_mutation_performed:false
+ };
+}

package/src/r67-native-observation-authority.mjs

@@ -0,0 +1,45 @@
+import {createHash} from 'node:crypto';
+import {codingSessionStatus} from './coding-plane.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const hash=s=>createHash('sha256').update(s,'utf8').digest('hex');
+
+/**
+ * A server-owned callback, never a model-supplied permission.
+ * Opt-in is separate from the coding standing grant; every request and its
+ * completion re-reads the live epoch and checks revocation.
+ */
+export function createR67NativeObservationAuthority({
+  getCodingPolicy,
+  enabled=false,
+  sessionStatus=codingSessionStatus,
+  rootId='projects'
+}={}){
+ if(typeof getCodingPolicy!=='function'||typeof sessionStatus!=='function')throw new TypeError('trusted runtime authority providers required');
+ if(typeof enabled!=='boolean')throw new TypeError('native observer opt-in must be boolean');
+ return async ({operation,args}={})=>{
+  if(!enabled)throw new Error('R67_NATIVE_OBSERVATION_DISABLED');
+  if(!['process','identity','map'].includes(operation)||!Array.isArray(args)||args[0]!==operation)
+   throw new Error('R67_NATIVE_OBSERVATION_SCOPE_DENIED');
+  if(operation==='map'&&args[1]!=='self')throw new Error('R67_NATIVE_OBSERVATION_OTHER_PID_DENIED');
+  if(operation==='identity'&&args[1]!=='self')throw new Error('R67_NATIVE_OBSERVATION_OTHER_PID_DENIED');
+  const policy=getCodingPolicy();
+  if(!policy||!HEX64.test(policy.policy_sha256??'')||!policy.roots?.[rootId]?.read)
+   throw new Error('R67_NATIVE_OBSERVATION_POLICY_MISSING');
+  const lease=await sessionStatus(policy);
+  const epoch=lease?.authority_epoch;
+  if(!lease?.armed||lease.standing!==true||lease.reason!=='standing-grant'||
+     !Array.isArray(lease.root_ids)||!lease.root_ids.includes(rootId)||
+     !HEX64.test(lease.instance_nonce??'')||
+     epoch?.trusted!==true||!Number.isSafeInteger(epoch.seq)||epoch.seq<1||
+     !HEX64.test(epoch.event_sha256??''))
+   throw new Error('R67_NATIVE_OBSERVATION_AUTHORITY_REVOKED');
+  const grantId='coding.r67.'+hash(lease.instance_nonce+':'+epoch.event_sha256).slice(0,32);
+  return Object.freeze({
+    grant_id:grantId,
+    policy_sha256:policy.policy_sha256,
+    scope:'native-observe-readonly',
+    authority_generation:epoch.seq
+  });
+ };
+}

package/src/r67-observation-receipt.mjs

@@ -0,0 +1,43 @@
+import {createHash,createPublicKey,sign as edSign} from 'node:crypto';
+
+export const R67_OBSERVATION_DOMAIN=Buffer.from('DEADBYTE-R67-OBSERVATION-V1\0','utf8');
+const isHex64=s=>typeof s==='string'&&/^[a-f0-9]{64}$/.test(s);
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const canonical=value=>JSON.stringify(
+  Array.isArray(value)?value.map(v=>JSON.parse(canonical(v))):
+  value!==null&&typeof value==='object'?
+    Object.fromEntries(Object.keys(value).sort().map(k=>[k,JSON.parse(canonical(value[k]))])):
+    value
+);
+export const hashR67Result=result=>sha(Buffer.from(canonical(result),'utf8'));
+
+export function signR67Observation({privateKey,publicKey,operation,requestSha256,executableSha256,result,observedAtUtc=new Date().toISOString()}){
+  if(!privateKey||!publicKey)throw new Error('R67 receipt signer must be supplied by trusted runtime; no implicit key generation');
+  if(!['process','identity','map','pe'].includes(operation)||!isHex64(requestSha256)||!isHex64(executableSha256))
+    throw new Error('R67 observation operation and 256-bit bindings required');
+  if(!result||result.schema!=='deadbyte.native-inspect.r67.v1'||!['ok','failed'].includes(result.status))
+    throw new Error('R67 result contract invalid');
+  if(result.status==='ok'&&(result.operation!==operation||!isHex64(result.data_sha256)||!result.data||
+    result.data_sha256!==sha(Buffer.from(JSON.stringify(result.data),'utf8'))))throw new Error('R67 result data digest invalid');
+  const timestamp=new Date(observedAtUtc);
+  if(!Number.isFinite(timestamp.getTime())||timestamp.toISOString()!==observedAtUtc)throw new Error('R67 observation timestamp invalid');
+  const key=publicKey?.type==='public'?publicKey:createPublicKey(publicKey);
+  const derived=createPublicKey(privateKey);
+  const spki=Buffer.from(key.export({type:'spki',format:'der'}));
+  const derivedSpki=Buffer.from(derived.export({type:'spki',format:'der'}));
+  if(key.asymmetricKeyType!=='ed25519'||!spki.equals(derivedSpki))throw new Error('R67 signer public/private identity mismatch');
+  const body={
+    schema:'deadbyte.native-observation-receipt.r67.v1',
+    observed_at_utc:observedAtUtc,
+    operation,
+    request_sha256:requestSha256,
+    executable_sha256:executableSha256,
+    result_status:result.status,
+    result_sha256:hashR67Result(result),
+    signer_key_id:sha(spki)
+  };
+  const receipt_sha256=sha(Buffer.from(canonical(body),'utf8'));
+  const signed={...body,receipt_sha256};
+  const signature=edSign(null,Buffer.concat([R67_OBSERVATION_DOMAIN,Buffer.from(canonical(signed),'utf8')]),privateKey);
+  return {...signed,attestation:{algorithm:'ed25519',key_id:body.signer_key_id,signature_base64:signature.toString('base64')}};
+}

package/src/r67-regression-shards.mjs

@@ -0,0 +1,176 @@
+import {createHash} from 'node:crypto';
+import {lstat,readdir,readFile} from 'node:fs/promises';
+import path from 'node:path';
+const sha=value=>createHash('sha256').update(Buffer.from(JSON.stringify(value),'utf8')).digest('hex');
+
+export function createR67ShardPlan(filenames,shardCount=32){
+ if(!Array.isArray(filenames)||!Number.isInteger(shardCount)||shardCount<1||shardCount>64)throw new Error('invalid shard plan');
+ if(!filenames.length||filenames.length<shardCount)throw new Error('insufficient regression files');
+ const sorted=[...filenames].sort();
+ if(sorted.some((n,i)=>typeof n!=='string'||!/^test\/[a-z0-9._-]+\.test\.mjs$/.test(n)||(i>0&&n===sorted[i-1])))
+  throw new Error('invalid or duplicate test filename');
+ // Measured on Windows: 53.2s controller lifecycle and 110.4s remote lifecycle.
+ // Assign both to standalone tail shards; smaller shard counts reserve at least one normal shard.
+ const measured=['test/r58-controller-live-local.test.mjs','test/remote-session-cli.test.mjs'];
+ const present=measured.filter(name=>sorted.includes(name));
+ const isolated=present.slice(-Math.min(present.length,shardCount-1));
+ const isolatedSet=new Set(isolated);
+ const normal=sorted.filter(name=>!isolatedSet.has(name));
+ const normalShardCount=shardCount-isolated.length;
+ const shards=Array.from({length:shardCount},(_,index)=>({index,files:[]}));
+ normal.forEach((name,index)=>shards[index%normalShardCount].files.push(name));
+ isolated.forEach((name,index)=>shards[normalShardCount+index].files.push(name));
+ const plan_sha256=sha({schema:'deadbyte.r67-shard-plan.v1',shardCount,files:sorted,
+  assignment:'measured-slow-suites-isolation-v2',isolated});
+ return {schema:'deadbyte.r67-shard-plan.v1',plan_sha256,file_count:sorted.length,
+  shards:shards.map(s=>({...s,files_sha256:sha(s.files)}))};
+}
+export function r67ShardTimeoutMs(shard){
+ if(!shard||!Array.isArray(shard.files))throw new Error('invalid shard');
+ if(shard.files.length===1&&shard.files[0]==='test/remote-session-cli.test.mjs')return 165000;
+ if(shard.files.length===1&&shard.files[0]==='test/r58-controller-live-local.test.mjs')return 120000;
+ return 58000;
+}
+export function reconcileR67Shards(plan,receipts){
+ if(!plan||plan.schema!=='deadbyte.r67-shard-plan.v1'||!Array.isArray(plan.shards)||!Array.isArray(receipts))throw new Error('invalid shard proof input');
+ const seen=new Map();
+ for(const r of receipts){
+  if(!Number.isInteger(r?.shard_index)||r.shard_index<0||r.shard_index>=plan.shards.length)throw new Error('out-of-plan shard');
+  if(seen.has(r.shard_index))throw new Error('duplicate shard receipt');
+  seen.set(r.shard_index,r);
+ }
+ const missing=plan.shards.filter(s=>!seen.has(s.index)).map(s=>s.index);
+ let tampered=false,failed=false,unknown=false,passed=0,failureCount=0,testCount=0;
+ for(const shard of plan.shards){
+  const r=seen.get(shard.index);if(!r)continue;
+  const missingCounts=r.status==='OUTCOME_UNKNOWN'&&r.test_count===null&&r.passed===null&&r.failed===null;
+  const validCounts=Number.isInteger(r.test_count)&&r.test_count>=0&&
+    Number.isInteger(r.passed)&&r.passed>=0&&Number.isInteger(r.failed)&&r.failed>=0&&
+    r.passed+r.failed<=r.test_count;
+  if(r.plan_sha256!==plan.plan_sha256||r.files_sha256!==shard.files_sha256||
+    !['PASS','FAILED','OUTCOME_UNKNOWN'].includes(r.status)||!(missingCounts||validCounts)){tampered=true;continue;}
+  if(r.schema==='deadbyte.r67-shard-result.v2'){
+   const unknownWithoutCounts=r.status==='OUTCOME_UNKNOWN'&&missingCounts&&r.skipped===null&&r.cancelled===null&&r.todo===null;
+   const complete=validCounts&&Number.isInteger(r.skipped)&&r.skipped>=0&&
+    Number.isInteger(r.cancelled)&&r.cancelled===0&&Number.isInteger(r.todo)&&r.todo===0&&
+    r.passed+r.failed+r.skipped+r.cancelled+r.todo===r.test_count;
+   if(!(unknownWithoutCounts||complete)){tampered=true;continue;}
+  }
+  if(r.status==='PASS'&&(r.exit_code!==0||r.failed!==0||r.test_count<shard.files.length))tampered=true;
+  if(r.status==='FAILED'||r.exit_code!==0&&r.status!=='OUTCOME_UNKNOWN'||r.failed>0)failed=true;
+  if(r.status==='OUTCOME_UNKNOWN')unknown=true;
+  passed+=r.passed;failureCount+=r.failed;testCount+=r.test_count;
+ }
+ const status=tampered||failed?'FAILED':missing.length?'BLOCKED':unknown?'OUTCOME_UNKNOWN':'PASS';
+ return {schema:'deadbyte.r67-shard-reconciliation.v1',status,plan_sha256:plan.plan_sha256,
+  file_count:plan.file_count,shards_expected:plan.shards.length,shards_observed:seen.size,
+  missing,test_count:testCount,passed,failed:failureCount,integrity_failed:tampered};
+}
+
+/** Bind regression evidence to executable SOURCE bytes, not just test filenames. */
+export async function r67RegressionTreeHash(root,{roots=['src','test','scripts','controller','bridge','native','docs'],
+ topLevel=['package.json','package-lock.json'],extra=['bin/deadbyte-native-inspect-r67.exe']}={}){
+ if(typeof root!=='string'||!root)throw new Error('regression source root required');
+ const seeds=[...roots,...topLevel,...extra];
+ if(!seeds.length||seeds.some(n=>typeof n!=='string'||!n||n.includes('\\')||n.split('/').some(part=>!part||part==='.'||part==='..')))
+  throw new Error('invalid regression source scope');
+ const entries=[];
+ let total=0;
+ const seen=new Set();
+ async function visit(rel){
+  if(seen.has(rel))throw new Error('duplicate regression source path');
+  seen.add(rel);
+  const file=path.join(root,...rel.split('/'));
+  const info=await lstat(file);
+  if(info.isSymbolicLink())throw new Error('symlink forbidden in regression source tree: '+rel);
+  if(info.isDirectory()){
+   const children=(await readdir(file)).sort();
+   for(const child of children)await visit(rel+'/'+child);
+   return;
+  }
+  if(!info.isFile()||info.size>8*1024*1024)throw new Error('non-file/oversized regression source: '+rel);
+  if(entries.length>=5000||total+info.size>128*1024*1024)throw new Error('regression source budget exceeded');
+  const bytes=await readFile(file);
+  if(bytes.length!==info.size)throw new Error('regression source changed during read: '+rel);
+  total+=bytes.length;
+  entries.push([rel,bytes.length,createHash('sha256').update(bytes).digest('hex')]);
+ }
+ for(const seed of seeds)await visit(seed);
+ entries.sort((a,b)=>a[0].localeCompare(b[0],'en'));
+ return {schema:'deadbyte.r67-source-tree.v1',
+  sha256:sha({schema:'deadbyte.r67-source-tree.v1',files:entries}),
+  file_count:entries.length,bytes_total:total};
+}
+
+/** Parse complete Node TAP totals without treating missing or cancelled output as success. */
+export function parseR67TapSummary(output){
+ if(typeof output!=='string')return null;
+ const counts=Object.create(null);
+ const keys=['tests','pass','fail','cancelled','skipped','todo'];
+ for(const raw of output.split(/\r?\n/)){
+  const line=raw.trim();
+  const match=/^(?:#|ℹ)\s+(tests|pass|fail|cancelled|skipped|todo)\s+(\d+)$/u.exec(line);
+  if(!match)continue;
+  if(Object.hasOwn(counts,match[1]))return null;
+  const n=Number(match[2]);
+  if(!Number.isSafeInteger(n))return null;
+  counts[match[1]]=n;
+ }
+ if(keys.some(k=>!Number.isSafeInteger(counts[k])))return null;
+ if(counts.tests!==counts.pass+counts.fail+counts.skipped+counts.cancelled+counts.todo)return null;
+ if(counts.cancelled!==0||counts.todo!==0)return null;
+ return Object.fromEntries(keys.map(k=>[k,counts[k]]));
+}
+
+export function parseR67NonpassCases(output){
+ if(typeof output!=='string'||output.length>16*1024*1024)throw new Error('bounded TAP text required');
+ const keys=['tests','pass','fail','cancelled','skipped','todo'];
+ const totals=Object.create(null);
+ for(const raw of output.split(/\r?\n/)){
+  const line=raw.trim();
+  const m=/^(?:#|ℹ)\s+(tests|pass|fail|cancelled|skipped|todo)\s+(\d+)$/u.exec(line);
+  if(!m)continue;
+  if(Object.hasOwn(totals,m[1]))return null;
+  totals[m[1]]=Number(m[2]);
+ }
+ if(keys.some(k=>!Number.isSafeInteger(totals[k])))return null;
+ if(totals.tests!==totals.pass+totals.fail+totals.cancelled+totals.skipped+totals.todo)return null;
+ const summary=totals;
+ const cases=[];
+ const RX=/^\s*(?:ok|not ok)\s+\d+\s+-\s+(.+?)\s+#\s+(SKIP|TODO)(?:\s+(.*\S))?\s*$/u;
+ for(const line of output.split(/\r?\n/)){
+  const match=RX.exec(line);
+  if(!match)continue;
+  const name=match[1].trim(),reason=match[3]?.trim()||null;
+  cases.push({kind:match[2],name,reason});
+  if(cases.length>10000)throw new Error('case ledger budget exceeded');
+ }
+ const expected=summary.skipped+summary.todo;
+ const actual=cases.filter(c=>c.kind==='SKIP').length+cases.filter(c=>c.kind==='TODO').length;
+ const unclassified=cases.filter(c=>!c.name||!c.reason).length+Math.max(0,expected-actual);
+ const countersMatch=summary.skipped===cases.filter(c=>c.kind==='SKIP').length&&
+  summary.todo===cases.filter(c=>c.kind==='TODO').length;
+ return {cases,expected_nonpass:expected,fully_classified:countersMatch&&unclassified===0,
+  unclassified_count:unclassified,counters_match:countersMatch};
+}
+
+
+/** Diagnostic-only FAILED TAP case identities. Never export stack traces or raw assertion messages. */
+export function parseR67FailedCases(output){
+ if(typeof output!=='string'||output.length>16*1024*1024)throw new Error('bounded TAP text required');
+ const tap=parseR67TapSummary(output);
+ if(!tap)return {cases:[],count:0,complete:false,expected:null};
+ const cases=[];
+ for(const line of output.split(/\r?\n/)){
+  const match=/^\s*not ok\s+\d+\s+-\s+(.+?)\s*(?:#.*)?$/u.exec(line);
+  if(!match)continue;
+  const name=match[1].trim();
+  if(!name)continue;
+  const sensitive=/sk-(?:proj|test|live|[a-z]{10})-|bearer\s+|authorization|password\s*[:=]|(?:[A-Z]:\\Users\\|\/home\/)[^\s]+/i.test(name);
+  const printable=!/[\x00-\x1f\x7f-\x9f]/u.test(name)&&name.length<=256;
+  cases.push({name:sensitive||!printable?'[redacted]':name,
+   name_sha256:createHash('sha256').update(Buffer.from(name,'utf8')).digest('hex')});
+  if(cases.length>128)throw new Error('failed-case ledger budget exceeded');
+ }
+ return {cases,count:cases.length,expected:tap.fail,complete:tap.fail===cases.length};
+}

package/src/r70-owner-approval.mjs

@@ -0,0 +1,78 @@
+import {createHash,createPublicKey,verify as verifySignature} from 'node:crypto';
+import {lstat,realpath} from 'node:fs/promises';
+import path from 'node:path';
+import {canonicalJson} from './canonical-json.mjs';
+
+const SUBJECT_SCHEMA='deadbyte.project-authority-subject.r70.v1';
+const APPROVAL_SCHEMA='deadbyte.project-owner-approval.r70.v1';
+const SCOPE='coding_autonomous_native_diff';
+const DOMAIN=Buffer.from('DEADBYTE-R70-PROJECT-OWNER-APPROVAL\0','utf8');
+const SHA=/^[0-9a-f]{64}$/;
+const ID=/^[A-Za-z0-9._-]{1,64}$/;
+const SUBJECT_FIELDS=['schema','scope','root_id','project_root','coding_policy_sha256',
+  'autonomous_policy_sha256','reviewed_artifact_sha256','issued_at_utc','expires_at_utc'];
+const APPROVAL_FIELDS=['schema','subject_sha256','owner_key_id','subject','signature_base64'];
+const EXPECTED_FIELDS=['rootId','projectRoot','codingPolicySha256','autonomousPolicySha256','reviewedArtifactSha256'];
+const hash=bytes=>createHash('sha256').update(bytes).digest('hex');
+const samePath=(a,b)=>process.platform==='win32'?a.toLowerCase()===b.toLowerCase():a===b;
+
+function exact(value,fields,label){
+  if(!value||typeof value!=='object'||Array.isArray(value))throw new Error(`${label} invalid`);
+  const keys=Object.keys(value);
+  for(const key of keys)if(!fields.includes(key))throw new Error(`${label} unknown field '${key}'`);
+  for(const key of fields)if(!Object.hasOwn(value,key))throw new Error(`${label} missing field '${key}'`);
+  return value;
+}
+function digest(value,label){if(typeof value!=='string'||!SHA.test(value))throw new Error(`${label} invalid SHA-256`);return value;}
+function instant(value,label){
+  if(typeof value!=='string'||!/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(value))throw new Error(`${label} invalid UTC`);
+  const parsed=Date.parse(value);
+  if(!Number.isFinite(parsed)||new Date(parsed).toISOString()!==value)throw new Error(`${label} invalid UTC`);
+  return parsed;
+}
+
+export async function verifyProjectOwnerApproval({approval,ownerPublicKey,expected,now=new Date()}={}){
+  exact(expected,EXPECTED_FIELDS,'owner approval expected subject');
+  exact(approval,APPROVAL_FIELDS,'owner approval');
+  exact(approval.subject,SUBJECT_FIELDS,'owner approval subject');
+  const subject=approval.subject;
+  if(approval.schema!==APPROVAL_SCHEMA||subject.schema!==SUBJECT_SCHEMA||subject.scope!==SCOPE)throw new Error('owner approval scope/schema mismatch');
+  if(typeof subject.root_id!=='string'||!ID.test(subject.root_id)||subject.root_id!==expected.rootId)throw new Error('owner approval root identity mismatch');
+  if(typeof subject.project_root!=='string'||!path.isAbsolute(subject.project_root)||
+     typeof expected.projectRoot!=='string'||!path.isAbsolute(expected.projectRoot))throw new Error('owner approval root path invalid');
+  let real;
+  try{
+    const entry=await lstat(expected.projectRoot);
+    if(!entry.isDirectory()||entry.isSymbolicLink())throw new Error('not a real directory');
+    real=await realpath(expected.projectRoot);
+  }catch{throw new Error('owner approval project root is not a real directory');}
+  if(!samePath(path.resolve(real),path.resolve(expected.projectRoot))||
+     !samePath(path.resolve(real),path.resolve(subject.project_root)))throw new Error('owner approval real root mismatch');
+  if(digest(subject.coding_policy_sha256,'coding policy')!==digest(expected.codingPolicySha256,'expected coding policy')||
+     digest(subject.autonomous_policy_sha256,'autonomous policy')!==digest(expected.autonomousPolicySha256,'expected autonomous policy')){
+    throw new Error('owner approval policy digest mismatch');
+  }
+  if(digest(subject.reviewed_artifact_sha256,'reviewed artifact')!==digest(expected.reviewedArtifactSha256,'expected reviewed artifact')){
+    throw new Error('owner approval reviewed artifact mismatch');
+  }
+  const issued=instant(subject.issued_at_utc,'owner approval issued time');
+  const expires=instant(subject.expires_at_utc,'owner approval expiry');
+  const observed=now instanceof Date?now.getTime():NaN;
+  if(!Number.isFinite(observed)||expires<=issued||expires-issued>3_600_000)throw new Error('owner approval lifetime invalid');
+  if(observed<issued||observed>=expires)throw new Error('owner approval expired or not yet valid');
+  const subjectSha=hash(Buffer.from(canonicalJson(subject),'utf8'));
+  if(digest(approval.subject_sha256,'owner approval subject')!==subjectSha)throw new Error('owner approval subject hash mismatch');
+  let key;
+  try{key=ownerPublicKey?.type==='public'?ownerPublicKey:createPublicKey(ownerPublicKey);}catch{throw new Error('owner approval public key invalid');}
+  if(key.asymmetricKeyType!=='ed25519')throw new Error('owner approval public key must be Ed25519');
+  const keyId=hash(key.export({type:'spki',format:'der'}));
+  if(digest(approval.owner_key_id,'owner approval key id')!==keyId)throw new Error('owner approval key identity mismatch');
+  if(typeof approval.signature_base64!=='string'||!/^[A-Za-z0-9+/]{86}==$/.test(approval.signature_base64))throw new Error('owner approval signature encoding invalid');
+  const signature=Buffer.from(approval.signature_base64,'base64');
+  const signed={schema:APPROVAL_SCHEMA,subject_sha256:subjectSha,owner_key_id:keyId};
+  if(signature.length!==64||!verifySignature(null,Buffer.concat([DOMAIN,Buffer.from(canonicalJson(signed),'utf8')]),key,signature)){
+    throw new Error('owner approval signature invalid');
+  }
+  return Object.freeze({approved:true,subject_sha256:subjectSha,owner_key_id:keyId,
+    project_root:real,root_id:subject.root_id,scope:SCOPE,expires_at_utc:subject.expires_at_utc});
+}